diff --git a/.jules/sentinel.md b/.jules/sentinel.md new file mode 100644 index 0000000..50425e1 --- /dev/null +++ b/.jules/sentinel.md @@ -0,0 +1,4 @@ +## 2024-06-28 - [Stack Overflow DoS in Interactive Prompts] +**Vulnerability:** Recursive calls to `readline()` in `checkCorrect()`, `checkoldformBILOGprior()`, and `checknewformBILOGprior()` without bounding. +**Learning:** In R, unchecked recursive function calls, especially for user input loops, can cause a C stack overflow, leading to a Denial of Service (session crash). +**Prevention:** Use iterative `while` loops instead of recursion for repeatedly prompting users until valid input is received. diff --git a/R/aFIPC.R b/R/aFIPC.R index b6a9e6c..e321df8 100644 --- a/R/aFIPC.R +++ b/R/aFIPC.R @@ -75,8 +75,8 @@ autoFIPC <- checkCorrect <- function() { n <- readline(prompt = "Is it correct? (1: Yes 2: No) : ") - if (!grepl("^[0-9]+$", n)) { - return(checkCorrect()) + while (!grepl("^[0-9]+$", n)) { + n <- readline(prompt = "Is it correct? (1: Yes 2: No) : ") } return(as.integer(n)) @@ -103,8 +103,11 @@ autoFIPC <- readline( prompt = "Do you want to use default BILOG-MG priors for oldform Data? (1: Yes 2: No) : " ) - if (!grepl("^[0-9]+$", n)) { - return(checkoldformBILOGprior()) + while (!grepl("^[0-9]+$", n)) { + n <- + readline( + prompt = "Do you want to use default BILOG-MG priors for oldform Data? (1: Yes 2: No) : " + ) } return(as.integer(n)) @@ -314,8 +317,11 @@ autoFIPC <- readline( prompt = "Do you want to use default BILOG-MG priors for newform Data? (1: Yes 2: No) : " ) - if (!grepl("^[0-9]+$", n)) { - return(checknewformBILOGprior()) + while (!grepl("^[0-9]+$", n)) { + n <- + readline( + prompt = "Do you want to use default BILOG-MG priors for newform Data? (1: Yes 2: No) : " + ) } return(as.integer(n))